The vulnerability allows an attacker who holds normal admin privileges to read, modify, or delete other administrators’ roles by submitting arbitrary role identifiers to protected endpoints. By changing a role’s menu and department grants, the attacker can effectively elevate their own permissions or alter the access of other users. This is a classic authorization bypass that aligns with CWE‑639, where the system trusts user‑controlled data to determine authorization.

Applications built with cool-admin-midway through version 8.0.0 are affected. The flaw resides in the /admin/sys/role/* endpoints and applies to any deployment of the software prior to or including the 8.0.0 release.

The vulnerability has a CVSS base score of 7, indicating a medium severity. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The issue is not listed in the CISA KEV catalog, implying limited widespread exploitation at this time. The likely attack vector is remote; an attacker needs to have a valid session with sys:role permissions and can trigger the exploit by sending crafted HTTP requests to the affected endpoints. The scope is limited to users with access to the sys:role permission, but the resulting privilege escalation can have significant impact on the overall administration of the system.